Import CSV and update multi value field

Elastic Stack Logstash
1

Greetings,

I'm importing large CSV files into elasticsearch using logstash. I'm prefixing specific values like this:

    filter {      
       if [path] =~ "xyz" {
         csv {
              separator => ";"
             columns =>
              [
                "IOT",
              "name",
                "surname",
               "addr",
               "XID",
               "ticketid"
              ]
          }

           if [IOT]{
           mutate {
              update => { "IOT" => "v-%{IOT}" }
          }
            }

Recently we discovered multi values fields in those files and now I want to add the prefix to each value in the field.

Example.csv

 IOT;name;surname;addr;XID;ticketid
 1;Mueller;Hans;42553;1;['9', '12', '13', '14']
 2;Meier;Peter;42873;2;['8', '14']

Right now those lines are beeing read like v-['8', '14'].

The output I need is something like [v-8, v-14].

Is there a way to achieve this in the logstash config? Maybe something like for each statement?

Also not sure if the multi value syntax in the csv is correct.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.